AWS Transit Gateway Cheat Sheet

• A networking service that uses a hub and spoke model to enable customers to connect their on-premises data centers and their Amazon Virtual Private Clouds (VPCs) to a single gateway.

• With this service, customers only have to create and manage a single connection from the central gateway into each on-premises data center, remote office, or VPC across your network.

• If a new VPC is created, you simply attach it to the Transit Gateway, making it available to every other connected network (subject to route table rules).

Features

• Inter-region Peering

  • Transit Gateway leverages the AWS global network to allow customers to route traffic across AWS Regions.

  • Inter-region peering provides an easy and cost-effective way to replicate data for geographic redundancy or to share resources between AWS Regions.

  Multicast

  • Enables customers to have fine-grain control on who can consume and produce multicast traffic.

  • It allows you to easily create and manage multicast groups in the cloud instead of the time-consuming task of deploying and managing legacy hardware on-premises.

  • This multicast solution is also scalable so the customers can simultaneously distribute a stream of content to multiple subscribers.

• Transit Gateway Connect (SD-WAN Integration)

  • Overview: Provides a native way to connect SD-WAN (Software-Defined Wide Area Network) appliances to AWS.

  • Mechanism: Uses GRE (Generic Routing Encapsulation) tunnels rather than IPsec VPNs, providing higher bandwidth performance.

  • Benefit: Removes the need for setting up public IP addresses or manually configuring IPsec VPNs for SD-WAN appliances.

  AWS Transit Gateway Network Manager

  • Centralized Monitoring: Provides a unified dashboard to visualize and monitor your global network across AWS and on-premises.

  • Route Analyzer: A feature that allows you to analyze and debug routing paths between resources to identify connectivity issues (e.g., “Why can’t VPC A reach the VPN?”).

  • Customers can automatically identify the Site-to-Site VPN connections and the on-premises resources with which they are associated using AWS Transit Gateway.

  Security & Traffic Inspection

  • Traffic Mirroring: You can enable traffic mirroring on Transit Gateway attachments to send a copy of network traffic to security appliances for content inspection and threat monitoring.

  • Centralized Egress: Allows you to route all internet-bound traffic from spoke VPCs through a central “Security VPC” for filtering.

AWS Transit Gateway Pricing

• Attachment: You are charged an hourly rate for each attachment (VPC, VPN, or Connect attachment) associated with your Transit Gateway.

• Data Processing: You are charged per GB for data processed by the Transit Gateway.

• Data Transfer: Standard AWS data transfer charges apply for traffic leaving AWS.

Note: If you are studying for the AWS Certified Advanced Networking Specialty exam, we highly recommend that you take our AWS Certified Advanced Networking – Specialty Practice Exams and read our Advanced Networking Specialty exam study guide.

Validate Your Knowledge

Question 1

A multinational bank has two data centers that are 60 miles (96.56 kilometers) from each other. The bank also has a single transit gateway that has multiple VPC and VPN attachments.

The Network team recently established two AWS Direct Connect connections from the company’s on-premises data centers to a Direct Connect location with the help of a local Direct Connect Partner. Afterward, they provisioned an AWS Direct Connect Gateway that connects to the AWS Direct Connect location via a transit virtual interface.

With this setup, what other network connections can be implemented? (Select TWO.)

1. Connect multiple VPCs in the same or different AWS account using the Direct Connect connection.
2. Associate multiple transit gateways in different AWS Regions to the Direct Connect Gateway and use the same ASNs for each transit gateway. Enable the Appliance mode for all transit gateways.
3. Allow on-premises servers to connect to AWS resources that are reachable via public IP addresses such as AWS public endpoints and S3 buckets. Configure the Appliance mode on the existing transit gateway.
4. Use equal-cost multi-path routing (ECMP) to get higher VPN bandwidth by aggregating multiple VPN connections in different AWS Regions.
5. Associate multiple transit gateways in the same AWS Region.

Show me the answer!

 

Correct Answers: 1,5

A transit gateway enables you to attach VPCs and VPN connections in the same Region and route traffic between them. A transit gateway works across AWS accounts, and you can use AWS Resource Access Manager to share your transit gateway with other accounts. After you share a transit gateway with another AWS account, the account owner can attach their VPCs to your transit gateway. A user from either account can delete the attachment at any time.

You can enable multicast on a transit gateway, and then create a transit gateway multicast domain that allows multicast traffic to be sent from your multicast source to multicast group members over VPC attachments that you associate with the domain.

A transit virtual interface should be used to access one or more Amazon VPC Transit Gateways associated with Direct Connect gateways. You can use transit virtual interfaces with 1/2/5/10 Gbps AWS Direct Connect connections.

To connect to your resources hosted in an Amazon VPC (using their private IP addresses) through a transit gateway, use a transit virtual interface. With a transit virtual interface, you can:

– Connect multiple VPCs in the same or different AWS account using DX.

– Associate up to three transit gateways in the same AWS Region when you use a transit virtual interface to connect to a DX gateway.

– Attach VPCs in the same AWS Region to the transit gateway. Then, access multiple VPCs in different AWS accounts in the same AWS Region using a transit virtual interface.

You can also create a peering connection attachment between transit gateways in different AWS Regions. This enables you to route traffic between the transit gateways’ attachments across different Regions.

You can use equal-cost multi-path routing (ECMP) to get higher VPN bandwidth by aggregating multiple VPN connections. However, you can only aggregate connections in the same AWS Region only. Alternatively, you can create a peering connection attachment between transit gateways in different AWS Regions to enable you to route traffic between the transit gateways’ attachments across different Regions.

Hence, the correct answers are:

– Connect multiple VPCs in the same or different AWS account using the Direct Connect connection.

– Associate multiple transit gateways in the same AWS Region.

The option that says: Associate multiple transit gateways in different AWS Regions to the Direct Connect Gateway and use the same ASNs for each transit gateway. Enable the Appliance mode for all transit gateways is incorrect. Although this is possible, you have to use unique ASNs for each transit gateway. Enabling the Application mode for the transit gateways serves no purpose as well. The Application mode simply ensures that the bidirectional traffic is routed symmetrically, whereby a request is routed through the same Availability Zone in the VPC attachment for the life of the flow.

The option that says: Allow on-premises servers to connect to AWS resources that are reachable via public IP addresses such as AWS public endpoints and S3 buckets. Configure the Appliance mode on the existing transit gateway is incorrect because this is only possible with a public virtual interface and not with a transit virtual interface. Just as explained in the previous option, the use of the Application mode for the Transit Gateway is not warranted in this scenario.

The option that says: Use equal-cost multi-path routing (ECMP) to get higher VPN bandwidth by aggregating multiple VPN connections in different AWS Regions is incorrect. Although you can use ECMP and aggregate multiple VPNs with Transit Gateway, these resources should be in the same AWS Region. An alternative solution is to establish a peering connection between two transit gateways in different AWS Regions, however, the scenario clearly mentioned that there is only a single transit gateway.

References:
https://aws.amazon.com/premiumsupport/knowledge-center/public-private-interface-dx/
https://docs.aws.amazon.com/vpc/latest/tgw/tgw-transit-gateways.html
https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways-intro.html

Note: This question was extracted from our AWS Certified Advanced Networking Specialty Practice Exams.

For more AWS practice exam questions with detailed explanations, visit the Tutorials Dojo Portal:

AWS Transit Gateway Cheat Sheet Reference:
https://aws.amazon.com/transit-gateway/